What should you not change before evidence is preserved after a suspected security incident?

Why this matters

The first hour of a suspected incident is when the most evidence is destroyed — almost always with good intentions. Someone reboots to clear a problem, an administrator removes a suspicious account, or a system is rebuilt to get the business running again. Each of those can eliminate the information needed to determine scope, and scope determines legal and regulatory obligations.

This is general educational guidance, not legal advice, and it does not replace qualified digital forensic direction. Where a matter may be litigable, regulated, or insured, obtain instruction from counsel and appropriately qualified practitioners before collecting or altering anything.

Avoid these actions before preservation

• Powering off or restarting an affected system — this destroys memory-resident evidence.
• Reimaging, rebuilding, or decommissioning affected hosts.
• Deleting suspicious accounts, files, scheduled tasks, or mailbox rules before they are captured.
• Running antivirus or malware removal tools that quarantine and delete artifacts on the affected host.
• Restoring from backup over the affected environment before its state is captured.
• Allowing log retention to expire — extend retention on identity, endpoint, network, email, and cloud audit logs immediately.
• Letting individuals investigate independently on the live system.
• Changing time settings or system clocks.
• Discussing attribution or conclusions in unprotected written channels.

What to do instead

• Isolate at the network level rather than powering down, where containment permits.
• Extend and export log retention across all relevant platforms as an immediate first action.
• Engage legal counsel, your insurer or broker, and qualified forensic support before collection.
• Start the chronology, decision log, and action log immediately.
• Restrict changes to a named set of responders and record every one.
• Rebuild into a clean environment rather than over the affected one where recovery cannot wait.

Questions to ask

• What log sources exist, and what is the retention period on each right now?
• Who currently has the ability to make changes to the affected systems?
• Has anything already been changed, deleted, or restarted — and is it recorded?
• Do our insurance terms require a specific responder or notification window?
• What does business continuity genuinely require in the next 24 hours, and can it be met without touching the affected environment?

When internal teams can handle it

Preservation discipline is achievable internally when the organization has an established incident process, defined authority to isolate systems, and a practiced relationship with counsel and its insurer.

When outside help may be appropriate

Nearly always for the forensic work itself. Coordination help is valuable when internal teams, vendors, counsel, and leadership are each acting on partial information and the sequence of actions needs to be controlled.